According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - A flaw exists in third-party PEAR Archive_Tar library.

 - A flaw exists in PHP's built-in phar stream wrapper that could lead to a remote code execution when performing file operations on an untrusted phar:// URI.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.62, 8.5.x prior to 8.5.9, or 8.6.x prior to 8.6.6. It is, therefore, affected by multiple phar handling vulnerabilities. An unauthenticated attacker could leverage these vulnerabilities to potentially perform remote code execution attacks and gain access in the context the web server user.

Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution.

For additional information, please refer to the upstream advisories at: https://www.drupal.org/sa-core-2019-001 and https://www.drupal.org/sa-core-2019-002

Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details. Also a possible regression caused by CVE-2019-6339 is fixed.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u15.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
98587	Drupal 8.6.x < 8.6.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
98585	Drupal 7.x < 7.62 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
98586	Drupal 8.x < 8.5.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	critical
121214	Drupal 7.x < 7.62 / 8.5.x < 8.5.9 / 8.6.x < 8.6.6 Multiple Vulnerabilities (SA-CORE-2019-001, SA-CORE-2019-002)	Nessus	CGI abuses	1/16/2019	4/11/2022	critical
121234	Debian DSA-4370-1 : drupal7 - security update	Nessus	Debian Local Security Checks	1/18/2019	2/24/2020	critical
122320	Debian DLA-1685-1 : drupal7 security update	Nessus	Debian Local Security Checks	2/20/2019	6/19/2024	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high